Webhook Signature Validator

What Is Webhook Signature Validation?

Webhook signature validation is the process of verifying that an incoming webhook request genuinely came from the expected sender and hasn't been tampered with. Services like Stripe, GitHub, Slack, and many others sign their webhook payloads using HMAC (Hash-based Message Authentication Code) with a shared secret known only to the sender and the receiver.

By recomputing the HMAC signature on the received payload and comparing it to the signature included in the webhook headers, you can cryptographically verify the authenticity and integrity of the webhook — before processing it.

How to Use

1. Select the algorithm or service — Choose HMAC-SHA256, SHA1, SHA512, or a service-specific format (Stripe, GitHub, Slack).
2. Enter the webhook secret — The shared secret key your webhook provider gave you (e.g., whsec_... for Stripe).
3. Paste the signature header — The value from the Stripe-Signature, X-Hub-Signature-256, or similar header.
4. Paste the raw payload — The exact request body received by your webhook endpoint.
5. Click Validate Signature — The tool computes the expected signature and compares it to the provided one.

Common Webhook Signature Formats

FAQs